Play Store: IAP fails with java.lang.SecurityException

[jamorford]

Using IAP force closes the Play Store and the calling app. I have successfully made an IAP with the Play Store and microG in the past, so something may have changed permission-wise that broke it.

Using: Play Store 6.1.12 installed in /system/priv-app
Version: GmsCore Nightly 0.2.0
Tested with: Awesome Pop-Up Video, Battery Shutdown Manager, and Forest

Steps to reproduce:

1. Open an app with IAB
2. Initiate purchase
3. Play Store pops up and asks for payment method
4. Click "Buy"
5. Play Store and calling app force close with UID 10074 security exception. UID 10074 on my device is com.android.vending/Play Store according to /data/system/packages.list

2016-02-06-23-35-22.txt
2016-02-06-23-38-43.txt

[mar-v-in]

The error message suggests that Play Store is trying to access account information that is not accessible for it as it does not share microG's signature (this has nothing to do with signature spoofing, as this is a security restriction). This is not something that can be "fixed" directly and as you mentioned it worked for you before, this is probably due to the Play Store update 6.1.12. Can you try if downgrading Play Store fixes this issue again (as a temporary solution).

[jamorford]

Downgrading to 6.0.5, which was the previously working version, did not fix the issue

[Diapolo]

So is there way to use Play Store without the official Play Store app currently? Seems I'm getting a warning "ClassLoader referenced unknown path: /data/app/com.android.vending-1/lib/arm". Any ideas?

Edit: Problem was I didn't have Play Store in /system/priv-app. I was able to use and even update an App, but then Play Store updated itself and now doesn't connect anymore :-/.

Edit 2: Seems an App update is reinstalled in /data/app and not in /system/priv-app, so moving the current version (on my device 6.3.16.B-all [0] 2697688) again to /system/priv-app allows me to use Play Store to download and update Apps, very nice :)! Also I'm able to use the store with just storage and phone access (Android 6 rights)!?

[Catfriend1]

Play Store 6.4.12 and 6.5.8 still throw "java.lang.SecurityException" Error mentioned above when trying to buy an app from in-app purchase. Has anyone found a workaround in the meantime? Perhaps a PlayNeedle?

[budulinek]

It seems than Play Store 6.0 and above is affected by this issue (I have 6.0.5 and it still throws the same error).

The only solution is to install Play Store 5.x and disable automatic self-update of Google Play. This is very tricky...

SOLUTION

Probably the easiest solution is to install older version of Google Play which is modified to prevent self-update, for example this black themed Play Store:
http://forum.xda-developers.com/showthread.php?t=2287493
I can confirm that the black Play Store 5.1.11 from this xda thread does not self-update and does not suffer from the "java.lang.SecurityException" error. I am on Lollipop.

[Catfriend1]

The following raw extract from my Tasker Task "on-Boot" will disable nagging services, for the play store auto-update prevention, only "disable com.android.vending" lines are relevant.

Tasker-Setup-Services_extract.txt

I'd like to try the downgrade of play store, but for now, I'm too lazy doing it because then, all dependent installations of apps requiring play stores license service would be "disconnected" from the LicensingService-Permission. Afterwards, a reinstall of every app with connection to the license service would be required (had that already some time before).

[budulinek]

The last working Google Play is 5.4.12. I can confirm that your trick with disabling Play store services responsible for auto-update does work. But I prefer to use DisableService for disabling services. It is safer than Tasker.

[Catfriend1]

Cool, thanks for verifying. So we finally have two good methods solving the play store problems with newest updates.
P.S. My tasker script was generated from DisableService root commands so DisableService is also a good working solution.

[tristan-k]

@Catfriend1 @budulinek cn.wq.disableservice doesnt seem to be very trustworthy. Is there a open source alternative available?

[budulinek]

As far as I know, there is no alternative to Disable Service. But the newest version of Google Play works with microg without any problems, so you do not need to disable self update services in Google Play. Dne 27. listopadu 2016 2:27:17 PM ǝʞɔoʃʞ uɐʇsıɹʇ <notifications@github.com> napsal:

…

@Catfriend1 @budulinek [cn.wq.disableservice](https://play.google.com/store/apps/details?id=cn.wq.disableservice) doesnt seem to be very trustworthy. Is there a open source alternative available? -- You are receiving this because you were mentioned. Reply to this email directly or view it on GitHub: #88 (comment)

[tristan-k]

Not for me. I tried Google_Play_Store_7.2.13.J-all_0_PR_138561921.apk but it crashed immediately after trying to purchase the full version of Solid Explorer.

[budulinek]

That is strange. I have the same version of Google Play and everything is working fine, including purchases. I have MicroG with FakeGapps xposed module. Xiaomi Miui 8 Stable. Dne 27.11.2016 v 18:11 ǝʞɔoʃʞ uɐʇsıɹʇ napsal(a):

…

Not for me. I tried |Google_Play_Store_7.2.13.J-all_0_PR_138561921.apk| but it crashed immediately after trying to purchase the full version of Solid Explorer. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#88 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AFuR_7SBC37DZCcd8okFwIPlVan8qFl3ks5rCbm9gaJpZM4HVBQB>.

[Catfriend1]

So by the meantime, GPlay Store 8.4.18 works well purchasing on the mobile device also running MicroG GMSCore.

[ale5000-git]

@ibleedbinari: Does the problem still happen with the latest Play Store and the latest microG?

[jamorford]

@ale5000-git I'm not using microG actively at the moment, so I do not know

[jamorford]

#309 has more details on this issue and PR #767 has a working solution. Closing this issue as duplicate.